KR100621124B1 - Method for managing encryption key in wireless network and network apparatus using the same - Google Patents

Abstract

The present invention relates to a method for managing an encryption key in a wireless network and a network device using the same. The method for managing an encryption key in a wireless network according to the present invention provides a method for allowing a wireless network to temporarily participate in a specific wireless network. Generating, by the access point, a first encryption key, encrypting the first encryption key using a second encryption key set as an active key used to encrypt the data to be transmitted; And transmitting an active key to the first encryption key.

According to the present invention, when an external station temporarily participates in a specific wireless network, the wireless network can be more easily managed by automatically distributing a new encryption key to network devices constituting the wireless network while maintaining communication security.

Encryption Key, WEP, Key Distribution

Description

Method for managing encryption key in wireless network and network device using same {Method for managing encryption key in wireless network and network apparatus using the same}

1 is a diagram illustrating a home network system according to an embodiment of the present invention.

2 is a diagram illustrating a home network system according to another embodiment of the present invention.

3 is a block diagram illustrating an access point according to an embodiment of the present invention.

4 is a block diagram illustrating a station according to an embodiment of the present invention.

5 is a flowchart illustrating a visitor key distribution process in a wireless network according to an embodiment of the present invention.

6 is a flowchart illustrating a visitor key deletion process in a wireless network according to an embodiment of the present invention.

7 is a flowchart illustrating a process of delivering a visitor key to a powered station during a visitor mode according to an embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

111, 121: control module 112: encryption key generation module

113, 123: encryption module 114, 124: storage module

115, 125: wireless communication module 116: wired communication module

117, 127: user interface module

The present invention relates to a method for managing an encryption key in a wireless network and a network device using the same. More particularly, when an external network device temporarily participates in a specific wireless network, the network device constructs a wireless network while maintaining security in communication. The present invention relates to a cryptographic key management method capable of automatically distributing and deleting new cryptographic keys to a network, and a network device using the same.

With the development of communication and network technology, the recent network environment is changing from a wired network environment using a wired medium such as a coaxial cable or an optical cable to a wireless network environment using wireless signals of various frequency bands.

Unlike wired networks, wireless networks are less secure than other wired networks because their data transmission paths are not physically fixed. Thus, in an effort to perform more secure wireless communications, most wireless communication protocols support encryption of transmitted data packets.

For example, the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard for Wireless Local Area Network (WLAN) provides an encryption mechanism known as Wired Equivalent Privacy (WEP). The WEP performs encryption and decryption of data packets transmitted between network devices using an encryption key composed of a WEP key and an initialization vector (IV).

Network devices constituting the same wireless network share the same encryption key, and network devices that do not have the same encryption key cannot decrypt the encrypted data packet even if they receive the encrypted data packet. Therefore, the use of an encryption mechanism in a wireless network can increase the security of communication by preventing an external network device from accessing a specific wireless network.

On the other hand, in some cases, for security reasons, it is necessary to change the encryption key used in a specific wireless network to a new encryption key. For example, if a visitor's external network device needs to temporarily participate in a home network where wireless communication is secured using a specific encryption key, the home network administrator must change the encryption key used in the home network.

If the external network device can use the existing encryption key used in the home network, the holder of the external network device can freely participate in the home network without permission of the home network administrator in the area where communication with the home network is possible. do. Therefore, when an external network device temporarily accesses or disconnects from the home network, the home network administrator needs to change the encryption key being used in the home network.

In this way, if the encryption key being used in a specific wireless network is changed, all network devices in the same wireless network must share a new encryption key. In this situation, one of the problems caused by the conventional technology is that the user must manually change the encryption keys of the network devices constituting the wireless network.

For example, as described above, when the visitor's external network device temporarily accesses or disconnects from the home network, the home network administrator must change the encryption keys of each network device constituting the home network. In particular, when time-limited participation of external network devices frequently occurs in a specific wireless network, network management of the wireless network manager becomes more difficult.

Accordingly, there is a need for a simple encryption key management technology that can be used in the case of temporarily inviting external network devices to a specific wireless network.

According to the present invention, when an external network device temporarily participates in a specific wireless network, new encryption keys can be automatically distributed and deleted to each network device while maintaining security for communication between network devices constituting the same wireless network. The purpose is.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, in the method of managing an encryption key in a wireless network according to an embodiment of the present invention, the access point of the wireless network may be configured to use a first encryption key when allowing a temporary participation of an external network device in a specific wireless network. Generating, encrypting the first encryption key using a second encryption key set as an active key used to encrypt data to be transmitted, and transmitting the encrypted first encryption key to wireless network devices configuring the wireless network. Transmitting, and changing the active key to the first encryption key.

In order to achieve the above object, the encryption key management method in a wireless network according to an embodiment of the present invention, the wireless network device can identify the first encryption key and the first encryption key from the access point of the wireless network to which it belongs. Obtaining a key index that is present, and sending a response that the first encryption key has been obtained to the access point.

In order to achieve the above object, an access point according to an embodiment of the present invention is used to encrypt the data to be transmitted, an encryption key generation module for generating a first encryption key, to allow temporary participation of an external network device in a specific wireless network. An encryption module for encrypting the first encryption key using a second encryption key set as an active key, a wireless communication module for transmitting the encrypted first encryption key to wireless network devices constituting the wireless network, and the active key It includes a control module for changing the first encryption key.

In order to achieve the above object, the wireless network device according to an embodiment of the present invention is a wireless communication module for receiving from the access point a first encryption key encrypted with a second encryption key and a key index for identifying the first encryption key And a encryption module for decrypting the encrypted first encryption key and key index, and a storage module for storing the decrypted first encryption key and key index.

Specific details of other embodiments are included in the detailed description and the drawings.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a home network system according to an embodiment of the present invention.

The illustrated home network system includes an access point 110, one or more stations 120-140, a wired backbone network 160, and a gateway 170. For convenience of description, the wireless network 100 composed of the access point 110 and the stations 120 to 140 is referred to as a home network. In addition, in this embodiment, the access point 110 and the stations 120 to 140 constituting the home network 100 will be collectively referred to as a wireless network device.

Meanwhile, in describing the present invention, a station may include a network device capable of performing communication through a wireless medium by connecting to a wireless network (home network 100 in the present embodiment) such as a notebook, a cellular phone, a digital TV, and a set-top box. it means. In addition, the access point refers to a network access control device that can control the connection to the wireless network to the station. In particular, as an embodiment of the present invention, an access point and a station may be understood as a concept of an access point and a station defined in the IEEE802.11 standard for the WLAN.

The wireless network devices 110 to 140 encrypt a data packet to be transmitted or decrypt a received encrypted data packet by using a predetermined encryption key to increase the security of the wireless communication. As an example of such an encryption key, an encryption key in the WEP method defined in the IEEE802.11 standard may be used, and in this case, the encryption key may be generated by a combination of an IV and a WEP key. However, the present invention is not limited thereto, and an encryption key suitable for an encryption algorithm used in a wireless network may be used.

The encryption key is shared between the wireless network devices 110 to 140 constituting the home network 100, so that the external station 150 that does not know the encryption key cannot participate in the home network 100.

In some cases, the wireless network devices 110 to 140 may share one or more encryption keys. In this case, an identifier (hereinafter, referred to as a key index) for identifying an encryption key may be set for each encryption key, and when the wireless network devices 110 to 140 encrypt and transmit a data packet, an encryption key used for encryption. The key index of can be sent together. Therefore, the wireless network device that receives the encrypted data packet and the key index can search for an encryption key that can decrypt the encrypted data packet through the key index from among the encryption keys stored therein and decrypt the data packet with the retrieved encryption key. have. Although not specifically mentioned below, the encrypted data packet between the wireless network devices 110 to 140 is transmitted along with the key index of the encryption key that encrypts it, and the wireless network device receiving the encrypted data packet is encrypted through the received key index. It should be understood that the encryption key for decrypting can be retrieved.

This may enable secure communication between wireless network devices 110-140 that share an encryption key and a key index. Hereinafter, an encryption key used by the wireless network devices 110 to 140 to encrypt data packets is called an active key.

Meanwhile, each of the stations 120 to 140 may use an encryption key different from the encryption key used by the access point 110 as the active key. In this case, the access point 110 and the stations 120 to 140 may each share an encryption key used as an active key and a key index of the corresponding encryption key.

The communication environment in this embodiment is largely a communication environment (hereinafter referred to as home mode) between the wireless network devices 110 to 140 constituting the home network 100 without the participation of the external station 150 and the external station 150. If the user is allowed to participate in the home network 100 for a limited time (for example, when the visitor's own station 150 allows the home network 100 to access the home network 100), the communication environment (hereinafter referred to as visitor mode) may be classified. Can be.

When the home network 100 needs to be switched from the home mode to the visitor mode, the access point 110 generates an encryption key (hereinafter referred to as a visitor key) that the external station 150 can use as an active key in the visitor mode. The access point 110 that generates the visitor key encrypts the visitor key with its active key and transmits the visitor key to the stations 120 to 140. The active key of the access point 110 is shared with the stations 120 to 140 in advance. On the other hand, the visitor key is preferably transmitted along with a key index for identifying the visitor key.

The stations 120 to 140 may decrypt the encrypted visitor key transmitted from the access point 110 with the same encryption key as the active key of the access point 110 to obtain a key index of the visitor key and the visitor key. Stations 120 to 140 that have obtained the visitor key may decrypt data encrypted with the visitor key. In some cases, the stations 120 to 140 may set the visitor key as their active key.

When the stations 120 to 140 obtain the visitor key, the access point 110 sets the visitor key as its active key. At this time, the home network administrator 100 may input the visitor key to the external station 150, thereby allowing the external station 150 possessed by the visitor to participate in the home network 100 communication through the access point 110. do.

Meanwhile, when the home network 100 needs to be switched from the visitor mode to the home mode (for example, when the visitor needs to terminate the access to the home network 100 of the external station 150 by completing the visit), the access point 110 The encryption key used in the existing home mode may be set as the active key again, and the stations 120 to 140 may be requested to delete the visitor key. In this case, the data transmitted from the access point 110 is encrypted with the newly set active key by the access point 110 and the stations 120 to 140 storing the same encryption key are transmitted from the access point 110. The data can be decrypted.

In response to a request of the access point 110, the stations 120 to 140 delete the visitor key. The station that set the visitor key as its active key in the visitor mode uses its own encryption key used in the existing home mode. Can be set with an active key.

When the stations 120 to 140 constituting the home network 100 delete the visitor key, the access point 110 also deletes the visitor key.

As such, when the home network 100 switches from the visitor mode to the home mode, the access point 110 and the stations 120 to 140 set the encryption key used in the existing home mode as the active key and delete the visitor key. Then, the external station 150 that does not know the encryption key used in the home mode can no longer participate in the communication of the home network 100.

Meanwhile, the access point 110 may be connected to the gateway 170 through the wired backbone network 160, through which the stations 120 to 140 may communicate with an external network.

In addition, the access point 110 may be connected to one or more other access points (not shown) through the wired backbone network 160. In this case, the home network may be understood as a concept including a wired backbone network 160 and a wireless network formed through another access point, which will be described with reference to FIG. 2.

2 is a diagram illustrating a home network system according to another embodiment of the present invention.

The illustrated home network system includes two wireless networks 400 and 200 formed through a first access point 410 and a second access point 210 and a wired backbone network connecting the access points 410 and 210 to each other. 300). Stations 420 to 440 belonging to the first wireless network 400 and stations 220 and 230 belonging to the second wireless network 200 through respective access points 410 and 210 and the wired backbone network 300. Communication can be performed between them.

When the external station 450 joins the first wireless network 400, the first access point 410 performs the same operation as described with the access point 110 of FIG. ) Can be switched to visitor mode.

In this case, the first access point 410 may transfer the visitor key generated by the first access point 410 to the second access point 210 through the wired backbone network 300. Even when data is transmitted through the wired backbone network 300, the data to be transmitted may be encrypted through a predetermined encryption algorithm.

The second access point 210 that receives the visitor's key from the first access point 410 also performs a similar operation as described through the access point 110 of FIG. 1 to perform stations of the wireless network 200 to which it belongs. Visitor keys may be passed to (220, 230). As a result, the access point 210 and the stations 220 and 230 of the second wireless network 200 may also store the visitor key, and the entire home network system may be switched to the visitor mode.

In this case, the second access point 210 may also set the visitor key as its active key to prepare for the case where the external station 450 roams from the first wireless network 400 to the second wireless network 200.

While the home network system has been described as an embodiment of the present invention, the present invention is not limited thereto, and another type of wireless network system including access points and stations described through the present invention also belongs to an embodiment of the present invention. Should be seen.

Hereinafter, the configuration of an access point and a station according to an embodiment of the present invention will be described in more detail with reference to FIGS. 1, 3, and 4.

3 is a block diagram illustrating an access point according to an embodiment of the present invention.

The illustrated access point 110 includes a control module 111, an encryption key generation module 112, an encryption module 113, a storage module 114, and a wireless communication module 115. In addition, the access point 110 may further include a wired communication module 116 and a user interface module 117.

The control module 111 controls an authentication process with a station to first join the home network 100. This authentication process can follow the conventional technology, for example, authentication using a SSID (Service Set Identifier), Open System authentication using a MAC (Medium Access Control) address, and sharing between wireless network devices. Authentication using a WEP key can be used.

Meanwhile, when switching the home network 100 from the home mode to the visitor mode, the control module 111 generates a key addition message to be transmitted to each station 120 to 140. The key addition message is a message requesting that stations 120 to 140 store the visitor key.

The control module 111 generating the key addition message encrypts the key addition message and the visitor key through the encryption module 113 and transmits the key addition message to the stations 120 through 140 through the wireless communication module 115. The visitor key is preferably transmitted together with the key index of the visitor key, and it can be understood that the key index can also be encrypted and transmitted together with the visitor key, unless otherwise specified.

On the other hand, the control module 111 may store the encrypted data transmitted at this time in the storage module 114, and power is supplied while the home network 100 of the stations 120 to 140 operates in the visitor mode. It can also send it to provide the visitor key to the station.

If the visitor key is successfully delivered to all the stations 120 to 140, the control module 111 sets the visitor key as the active key. Whether the visitor key is successfully delivered to the stations 120 to 140 may be confirmed through a predetermined message received from the stations 120 to 140. Even if a message regarding whether the visitor key is successfully delivered from the station is not received, the control module 111 may set the visitor key as the active key after a certain time elapses from the time when the visitor key is transmitted.

When the home network 100 is switched from the visitor mode to the home mode, the control module 111 sets the encryption key used in the existing home mode stored in the storage module 114 as the active key. Thereafter, the control module 111 generates a key deletion message to be delivered to each station 120 to 140. The key deletion message is a message requesting that the stations 120 to 140 delete the visitor key, and may be transmitted with a key index that can identify the visitor key.

The control module 111 may also encrypt the key deletion message through the encryption module 113 and then transmit the key deletion message to the stations 120 through 140 through the wireless communication module 115. The encrypted key deletion message may be stored in the storage module 114, and the control module 111 may cut off the power while operating in the visitor mode and then transmit the power to the powered station in the home mode.

When the stations 120 to 140 receiving the key deletion message delete the visitor key, the control module 111 may delete the visitor key stored in the storage module 114. The visitor key deletion may be performed when a response message for the visitor key deletion is received from all stations 120 to 140, or when a predetermined time has elapsed from the time when the key deletion message is transmitted.

In addition, the control module 111 controls the operation of each functional block constituting the access point.

The encryption key generation module 112 generates a predetermined encryption key (for example, a visitor key) under the control of the control module 111. As an example of such an encryption key, the encryption key in the WEP method defined in the IEEE802.11 standard can be used, and the encryption key in the WEP method is composed of an IV and a WEP key. However, the present invention is not limited thereto, and the encryption key generation module 112 may generate an encryption key suitable for an encryption algorithm used in a wireless network.

Meanwhile, the encryption key generation module 112 may provide a key index together with the encryption key to identify the encryption key generated by the encryption key generation module 112.

The encryption module 113 encrypts data to be transmitted to the station using the active key set by the control module 111. The active key may be an encryption key generated by the encryption key generation module 112. In addition, the encryption module 113 may decrypt the data received from the station. The encryption key used for decryption is the same encryption key as the station's active key. When receiving encrypted data from the station, the storage module 114 searches for the same encryption key as the station's active key through the received key index. can do.

As an encryption algorithm used in the encryption module 113, an algorithm corresponding to the protocol of the wireless network may be used. For example, the encryption module 113 may perform RC4 encryption used in the WEP method.

The storage module 114 stores one or more encryption keys generated by the encryption key generation module 112 and a key index of each encryption key. In addition, as mentioned in the description of the control module 111, an encrypted key addition message (including a visitor key and a key index) and a key deletion message may be stored.

The wireless communication module 115 transmits data encrypted by the encryption module 113 to each of the stations 120 to 140, and receives data transmitted from the stations 120 to 140.

The wireless communication module 115 may perform communication according to a protocol defined in the IEEE 802.11 standard for WLAN.

The wired communication module 116 is connected to a wired backbone network to perform communication with an external network or another access point.

The user interface module 117 receives a user's control command. Therefore, when the user wants to switch the home network to the home mode or the visitor mode, the user may indicate this through the user interface module 117. In this case, the control module 111 may control the operation of the functional blocks constituting the access point 110 according to a user's instruction input through the user interface module 117.

4 is a block diagram illustrating a station according to an embodiment of the present invention.

The illustrated station includes a control module 121, an encryption module 123, a storage module 124, a wireless communication module 125, and a user interface module 127. Although the illustrated station uses an identification code of 120, other stations 130 and 140 constituting the home network may also include the same functional blocks as the illustrated station 120.

The control module 121 may decrypt the encrypted data received from the access point 110 through the encryption module 123. If the received data is a key addition message, the control module 121 stores the visitor key and the key index received together with the storage module 124. In this case, the control module 121 may generate a key addition confirmation message and transmit the generated key addition confirmation message to the access point 110.

If the received data is a key deletion message, the control module 121 may delete the visitor key stored in the storage module 124. In this case, the control module 121 generates a key deletion confirmation message to access the access point 110. Can be sent to. The visitor key can be searched through the key index of the visitor key received with the key deletion message.

Meanwhile, the control module 121 may set the visitor key as the active key in some cases. In addition, the control module 121 controls the operation of each functional block constituting the station 120.

The encryption module 123 encrypts data to be transmitted to the access point 110 using the active key. The encryption key may be stored in the storage module 124 and may be input by the user when the station 120 joins the home network 100 for the first time.

In addition, the encryption module 123 may decrypt the encrypted data received from the access point 110. The encryption key used for decryption is an active key of the access point 110. When receiving encrypted data from the access point 110, the encryption key is accessed through the key index of the active key of the access point 110 received with the encrypted data. The same encryption key as the active key of 110 may be retrieved from the storage module 124.

As the encryption algorithm used in the encryption module 123, an algorithm corresponding to the protocol of the wireless network may be used. For example, the encryption module 123 may perform RC4 encryption used in the WEP method.

The storage module 124 stores the visitor key and the key index of the visitor key received from the access point 110. In addition, the storage module 124 may store an encryption key other than the visitor key and a key index of the corresponding encryption key. One such encryption key is used as the active key of the station 120.

The wireless communication module 125 transmits data encrypted by the encryption module 123 to the access point 110, and receives data transmitted from the access point 110. In this case, the wireless communication module 125 may perform communication according to a protocol defined in the IEEE 802.11 standard for the WLAN.

The user interface module 127 receives a control command of a user. Accordingly, the user may input information (eg, SSID, encryption key) necessary for joining the station 120 to the first home network 100 through the user interface module 127.

The operation of the functional blocks constituting the access point 110 and the station 120 will be described in more detail with reference to FIGS. 5 to 7.

5 is a flowchart illustrating a visitor key distribution process in a wireless network according to an embodiment of the present invention.

When receiving a request for switching to the visitor mode from the home network administrator through the first user interface module 117 (S110), the encryption key generation module 112 of the access point 110 generates an encryption key to be used as the visitor key. (S120). The generated visitor key is stored in the storage module 114 with a key index that can be distinguished from other encryption keys.

When the visitor key is generated, the control module 111 generates a key addition message and transmits it to the station 120 through the wireless communication module 115 (S130). In this case, the key addition message may include a generated visitor key and a key index for identifying the visitor key, and data transmitted to the station 120 is encrypted by the encryption module 113 with the active key of the access point 110. It is a state.

Upon receiving the key addition message from the access point 110, the encryption module 123 of the station 120 may decrypt the received data using the same encryption key as the active key of the access point 110, thereby accessing the access point. The visitor key and the key index transmitted from 110 are acquired (S140). The control module 121 of the station 120 stores the visitor key and the key index in the storage module 124. As a result, the station 120 storing the visitor key can decrypt the data encrypted with the visitor key.

The control module 121 of the station 120 storing the visitor key generates a key addition confirmation message and transmits the key addition confirmation message to the access point 110 through the wireless communication module 125 (S150). Data transmitted from the station 120 is encrypted with the active key of the station 120 by the encryption module 123 of the station 120.

This process occurs for all stations 120 to 140 that make up the home network 100. When the key addition confirmation message is received from each of the stations 120 to 140, the control module 111 of the access point 110 sets the visitor key as the active key (S160). Even if there is a station that has not transmitted the key addition confirmation message, the control module 111 may set the visitor key as an active key when a predetermined time elapses from the time of transmitting the key addition message.

In addition, when a message indicating that key addition has failed from a specific station is received, the control module 111 may transmit the key addition message of step S130 to the corresponding station again.

Meanwhile, the home network manager 100 may input the visitor key to the external station 150 through a user interface (not shown) provided in the external station 150.

As a result, the wireless network devices 110 to 140 and the external station 150 constituting the home network share the visitor key, and the external station 150 can participate in the home network 100 using the visitor key. .

6 is a flowchart illustrating a visitor key deletion process in a wireless network according to an embodiment of the present invention.

When the home network manager requests to switch to the home mode in order to disconnect the external station 150 from the home network (S210), the control module 111 of the access point 110 uses the password used in the existing home mode. The key is set as an active key (S220).

Thereafter, the control module 111 of the access point generates a visitor key deletion request message and transmits the visitor key deletion request message to the station 120 through the wireless communication module 115 (S230). In this case, a key index for identifying the visitor key may be transmitted together, and the data transmitted from the access point 110 is data encrypted by the encryption module 113 using the newly set active key.

The encryption module 123 of the station 120 receiving the key deletion message from the access point 110 may decrypt the key deletion message by using the same encryption key as the active key of the access point 110. At this time, according to the request of the access point 110, the control module 121 deletes the visitor key stored in the storage module 124 (S240). The visitor key can be retrieved through the key index of the visitor key sent with the key deletion message.

In this case, the control module 121 of the station 120 that sets the visitor key as the active key in the visitor mode may set the encryption key used in the existing home mode as its active key.

The control module 121 of the station 120 deleting the visitor key generates a key deletion confirmation message and transmits the generated key deletion confirmation message to the access point 110 through the wireless communication module 125 (S250). Data transmitted from the station 120 is encrypted with the active key of the station 120 by the encryption module 123 of the station 120.

This process occurs for all the stations 120 to 140 that make up the home network 110. When the key deletion confirmation response is received from the stations 120 to 140, the control module 111 of the access point 110 deletes the visitor key stored in the storage module 114 (S260).

As a result, the wireless network devices 110 to 140 constituting the home network 100 delete the visitor key, and the external station 150 that does not have the encryption key set by the access point 110 as the active key is the home network manager. It is impossible to connect to the home network 100 without permission.

Meanwhile, a station supplied with power in the visitor mode among the stations constituting the home network may not store the visitor key. Therefore, a process of delivering a visitor key to such a station may be necessary, which will be described with reference to FIG. 7.

7 is a flowchart illustrating a process of delivering a visitor key to a powered station 120 during a visitor mode according to an embodiment of the present invention.

When the station 120 is supplied with power in the visitor mode (S310), first, the control module 121 of the station 120 performs an authentication and connection process with the access point 110 (S320). This authentication and connection process may be an authentication and connection process defined in the conventional IEEE802.11 standard.

In the visitor mode, the control module 111 of the access point 110 that has completed the authentication and connection with the specific station 120 (S320) generates a key addition message as described above to generate a station along with the key index of the visitor key and the visitor key. It transmits to 120 (S330).

In this case, the transmitted data is data encrypted by the encryption module 113 using the encryption key used as the active key in the home mode. If the control module 111 of the access point has stored the encrypted key addition message transmitted to each station when switching from the home mode to the visitor mode in the storage module 114 as described above, the control module 111 stores the stored data. The key addition message stored in the module 114 may be sent.

The control module 121 of the station 120 may obtain the visitor key and the key index by decrypting the received key addition message through the encryption module 113 (S340). In this case, the control module 121 may store the visitor key and the key index in the storage module 124.

On the other hand, the external station 150 or the other external station does not know the encryption key used by the access point 110 as the active key in the home mode even when the home network 100 is powered in the visitor mode, so that the key addition message Cannot be decrypted.

The control module 121 of the station 120 that obtains the visitor key and the key index may generate a key addition confirmation message, encrypt it through the encryption module 113, and transmit the encrypted key to the access point 110 (S450).

If the station 120 is powered on in the home mode, the access point 110 may transmit only a key addition message that does not include the visitor key and the key index, and the station 120 that receives the visitor may send the visitor to the received data. The key is not included, so you can ignore it and operate in home mode.

Meanwhile, the above-described key addition message and key deletion message may be transmitted to the stations 120 to 140 individually or may be transmitted through broadcast. In addition, such a key addition message and a key deletion message may be transmitted in a beacon frame defined in the IEEE802.11 standard.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. You will understand that. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive.

According to the encryption key management method and a network device using the same in the wireless network of the present invention as described above, when an external station temporarily participates in a specific wireless network, the network devices constituting the wireless network can be secured while maintaining communication security. Automatic distribution of encryption keys makes wireless networks easier to manage.

Claims (20)

Generating, by the access point of the wireless network, a first encryption key when allowing a temporary participation of an external network device in a specific wireless network; Encrypting the first encryption key using a second encryption key set as an active key used to encrypt data to be transmitted; Transmitting the encrypted first encryption key to wireless network devices constituting the wireless network; And Changing the active key to the first encryption key. The method of claim 1, wherein the change of the active key has elapsed a predetermined time from a time when a response indicating that the first encryption key has been obtained from all the wireless network devices is received or when the encrypted first encryption key is transmitted. A cryptographic key management method in a wireless network that is performed in one case. 2. The method of claim 1, wherein encrypting the first encryption key comprises encrypting a key index identifying the first encryption key together with the first encryption key. The method of claim 1, further comprising: performing a predetermined authentication with the powered wireless network device when there is a powered wireless network device after the active key is changed among the wireless network devices; And And transmitting said encrypted first encryption key to said powered wireless network device. The method of claim 1, further comprising: when the external network device terminates the participation in the wireless network, the access point changes the active key back to the second encryption key and deletes the first encryption key. Encryption key management method in a wireless network. 6. The method of claim 5, wherein deleting the first encryption key comprises: the access point changing the active key back to the second encryption key; Requesting the wireless network devices to delete the first encryption key; And And deleting the first encryption key stored therein. The method of claim 6, wherein the deletion of the first encryption key has elapsed a predetermined time from the time when the deletion response of the first encryption key is received from all the wireless network devices or the request for deletion of the first encryption key is requested. A method of managing cryptographic keys in a wireless network if performed. Obtaining, by a wireless network device, a key index from which an access point of the wireless network to which the wireless network device belongs can identify a first encryption key and the first encryption key; And And transmitting a response indicating that the first encryption key has been obtained to the access point. 9. The method of claim 8, wherein obtaining the first encryption key and key index comprises: receiving the first encryption key and the key index encrypted with a second encryption key from the access point; Decrypting the encrypted first encryption key and key index using the second encryption key; And And storing the first encryption key and key index. The method of claim 8, further comprising: receiving a request for deletion of the first encryption key from the access point; Deleting the first encryption key according to the deletion request; And And transmitting a response to the deletion request to the access point. An encryption key generation module for generating a first encryption key to allow temporary participation of an external network device in a specific wireless network; An encryption module for encrypting the first encryption key using a second encryption key set as an active key used to encrypt data to be transmitted; A wireless communication module for transmitting the encrypted first encryption key to wireless network devices constituting the wireless network; And And a control module for changing the active key to the first encryption key. 12. The method of claim 11, wherein the change of the active key has elapsed a predetermined time from a time when a response indicating that the first encryption key is obtained from all the wireless network devices is received or when the encrypted first encryption key is transmitted. Access point performed in one case. The access point of claim 11, wherein the encryption module encrypts a key index with the first encryption key to identify the first encryption key. 12. The wireless network device of claim 11, wherein when there is a wireless network device that is powered after the active key is changed among the wireless network devices, the control module performs predetermined authentication with the powered wireless network device. An access point for transmitting the encrypted first encryption key to the powered wireless network device via a wireless communication module. The method of claim 11, further comprising: storing the first encryption key, a first key index for identifying the first encryption key, a second key index for identifying the second encryption key and the second encryption key. An access point further comprising a storage module. The control module of claim 15, wherein when the external network device terminates the participation in the wireless network, the control module changes the active key back to the second encryption key and deletes the first encryption key stored in the storage module. Access point. The access point of claim 16, wherein the control module requests the wireless network devices to delete the first encryption key through the wireless communication module. The storage module of claim 17, wherein the control module is further configured to store the storage module when a predetermined time has elapsed since a deletion response of the first encryption key is received from all of the wireless network devices or a request is made to delete the first encryption key. An access point for deleting the first encryption key stored in the server. A wireless communication module for receiving a first encryption key encrypted with a second encryption key and a key index for identifying the first encryption key from an access point; An encryption module for decrypting the encrypted first encryption key and key index; And And a storage module for storing the decrypted first encryption key and key index. 20. The method of claim 19, wherein when receiving the deletion request of the first encryption key from the access point, according to the deletion request, the first encryption key stored in the storage module is deleted, and the access point through the wireless communication module And a control module for transmitting a response to the request for deleting the first encryption key.

Images